_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:54:35.5000212Z'/><EventRecordID>30914</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:54:35.497</Data><Data Name='ProcessGuid'>{8c932ff3-844b-6962-2242-000000000800}</Data><Data Name='ProcessId'>7560</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{8c932ff3-844b-6962-2042-000000000800}</Data><Data Name='ParentProcessId'>7700</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:54:35.4925011Z'/><EventRecordID>30913</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 16:54:35.489</Data><Data Name='ProcessGuid'>{8c932ff3-844b-6962-2142-000000000800}</Data><Data Name='ProcessId'>4528</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{8c932ff3-844b-6962-2042-000000000800}</Data><Data Name='ParentProcessId'>7700</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:54:34.4821827Z'/><EventRecordID>30888</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 16:54:34.467</Data><Data Name='ProcessGuid'>{8c932ff3-844a-6962-1e42-000000000800}</Data><Data Name='ProcessId'>2788</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{8c932ff3-844a-6962-1d42-000000000800}</Data><Data Name='ParentProcessId'>6764</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:54:33.8346815Z'/><EventRecordID>30874</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:54:33.810</Data><Data Name='ProcessGuid'>{8c932ff3-8449-6962-1742-000000000800}</Data><Data Name='ProcessId'>7068</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{8c932ff3-8449-6962-1642-000000000800}</Data><Data Name='ParentProcessId'>7248</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:54:01.7778113Z'/><EventRecordID>31011</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:54:01.775</Data><Data Name='ProcessGuid'>{22c61f07-8429-6962-be41-000000000800}</Data><Data Name='ProcessId'>3576</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{22c61f07-8429-6962-bc41-000000000800}</Data><Data Name='ParentProcessId'>6048</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:54:01.7698749Z'/><EventRecordID>31010</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 16:54:01.745</Data><Data Name='ProcessGuid'>{22c61f07-8429-6962-bd41-000000000800}</Data><Data Name='ProcessId'>2036</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{22c61f07-8429-6962-bc41-000000000800}</Data><Data Name='ParentProcessId'>6048</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:54:01.0549992Z'/><EventRecordID>30985</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 16:54:01.051</Data><Data Name='ProcessGuid'>{22c61f07-8429-6962-ba41-000000000800}</Data><Data Name='ProcessId'>5572</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{22c61f07-8429-6962-b941-000000000800}</Data><Data Name='ParentProcessId'>6516</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:54:00.2458878Z'/><EventRecordID>30972</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:54:00.224</Data><Data Name='ProcessGuid'>{22c61f07-8428-6962-b341-000000000800}</Data><Data Name='ProcessId'>704</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{22c61f07-8428-6962-b241-000000000800}</Data><Data Name='ParentProcessId'>6492</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:53:45.2515238Z'/><EventRecordID>36568</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:53:45.249</Data><Data Name='ProcessGuid'>{677db45e-8419-6962-4e44-000000000800}</Data><Data Name='ProcessId'>6304</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{677db45e-8419-6962-4c44-000000000800}</Data><Data Name='ParentProcessId'>10068</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:53:45.2410857Z'/><EventRecordID>36567</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 16:53:45.238</Data><Data Name='ProcessGuid'>{677db45e-8419-6962-4d44-000000000800}</Data><Data Name='ProcessId'>4224</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{677db45e-8419-6962-4c44-000000000800}</Data><Data Name='ParentProcessId'>10068</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:53:44.3202630Z'/><EventRecordID>36554</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 16:53:44.316</Data><Data Name='ProcessGuid'>{677db45e-8418-6962-4b44-000000000800}</Data><Data Name='ProcessId'>5232</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{677db45e-8418-6962-4a44-000000000800}</Data><Data Name='ParentProcessId'>7320</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:53:41.2175705Z'/><EventRecordID>36501</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:53:41.207</Data><Data Name='ProcessGuid'>{677db45e-8415-6962-4344-000000000800}</Data><Data Name='ProcessId'>10052</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{677db45e-8415-6962-4244-000000000800}</Data><Data Name='ParentProcessId'>8708</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:41.0369994Z'/><EventRecordID>30777</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:51:41.034</Data><Data Name='ProcessGuid'>{43b9bf8b-839d-6962-3041-000000000800}</Data><Data Name='ProcessId'>7036</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{43b9bf8b-839c-6962-2e41-000000000800}</Data><Data Name='ParentProcessId'>6828</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:41.0276863Z'/><EventRecordID>30776</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 16:51:41.023</Data><Data Name='ProcessGuid'>{43b9bf8b-839d-6962-2f41-000000000800}</Data><Data Name='ProcessId'>6892</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{43b9bf8b-839c-6962-2e41-000000000800}</Data><Data Name='ParentProcessId'>6828</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:39.3908741Z'/><EventRecordID>30750</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 16:51:39.384</Data><Data Name='ProcessGuid'>{43b9bf8b-839b-6962-2c41-000000000800}</Data><Data Name='ProcessId'>2076</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{43b9bf8b-839b-6962-2b41-000000000800}</Data><Data Name='ParentProcessId'>7024</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:38.8105707Z'/><EventRecordID>30733</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:51:38.801</Data><Data Name='ProcessGuid'>{43b9bf8b-839a-6962-2541-000000000800}</Data><Data Name='ProcessId'>6644</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-839a-6962-2441-000000000800}</Data><Data Name='ParentProcessId'>6340</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:28.1953551Z'/><EventRecordID>51668</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:51:28.192</Data><Data Name='ProcessGuid'>{9f12f7c2-8390-6962-9842-000000000800}</Data><Data Name='ProcessId'>8184</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{9f12f7c2-8390-6962-9642-000000000800}</Data><Data Name='ParentProcessId'>5504</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:28.1889852Z'/><EventRecordID>51667</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 16:51:28.186</Data><Data Name='ProcessGuid'>{9f12f7c2-8390-6962-9742-000000000800}</Data><Data Name='ProcessId'>6044</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{9f12f7c2-8390-6962-9642-000000000800}</Data><Data Name='ParentProcessId'>5504</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:27.2858020Z'/><EventRecordID>51637</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 16:51:27.279</Data><Data Name='ProcessGuid'>{9f12f7c2-838f-6962-8f42-000000000800}</Data><Data Name='ProcessId'>6652</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{9f12f7c2-838f-6962-8e42-000000000800}</Data><Data Name='ParentProcessId'>7980</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:26.9619638Z'/><EventRecordID>51628</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:51:26.950</Data><Data Name='ProcessGuid'>{9f12f7c2-838e-6962-8d42-000000000800}</Data><Data Name='ProcessId'>7560</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{9f12f7c2-838e-6962-8c42-000000000800}</Data><Data Name='ParentProcessId'>6416</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:14.8905065Z'/><EventRecordID>31044</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:51:14.888</Data><Data Name='ProcessGuid'>{cad1564c-8382-6962-7d41-000000000800}</Data><Data Name='ProcessId'>7160</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{cad1564c-8382-6962-7b41-000000000800}</Data><Data Name='ParentProcessId'>5188</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:14.8846605Z'/><EventRecordID>31043</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 16:51:14.882</Data><Data Name='ProcessGuid'>{cad1564c-8382-6962-7c41-000000000800}</Data><Data Name='ProcessId'>6364</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{cad1564c-8382-6962-7b41-000000000800}</Data><Data Name='ParentProcessId'>5188</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:14.2243334Z'/><EventRecordID>31037</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 16:51:14.220</Data><Data Name='ProcessGuid'>{cad1564c-8382-6962-7a41-000000000800}</Data><Data Name='ProcessId'>528</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{cad1564c-8382-6962-7941-000000000800}</Data><Data Name='ParentProcessId'>3788</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:51:13.8832351Z'/><EventRecordID>31030</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:51:13.869</Data><Data Name='ProcessGuid'>{cad1564c-8381-6962-7841-000000000800}</Data><Data Name='ProcessId'>2608</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{cad1564c-8381-6962-7741-000000000800}</Data><Data Name='ParentProcessId'>6168</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:50:48.9040217Z'/><EventRecordID>31133</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:50:48.902</Data><Data Name='ProcessGuid'>{46de3de3-8368-6962-9141-000000000800}</Data><Data Name='ProcessId'>4188</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{46de3de3-8368-6962-8f41-000000000800}</Data><Data Name='ParentProcessId'>5840</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:50:48.8970599Z'/><EventRecordID>31132</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 16:50:48.893</Data><Data Name='ProcessGuid'>{46de3de3-8368-6962-9041-000000000800}</Data><Data Name='ProcessId'>6608</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{46de3de3-8368-6962-8f41-000000000800}</Data><Data Name='ParentProcessId'>5840</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:50:47.0025517Z'/><EventRecordID>31122</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 16:50:46.998</Data><Data Name='ProcessGuid'>{46de3de3-8366-6962-8e41-000000000800}</Data><Data Name='ProcessId'>6392</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{46de3de3-8366-6962-8d41-000000000800}</Data><Data Name='ParentProcessId'>6464</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:50:46.1908209Z'/><EventRecordID>31089</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 16:50:46.177</Data><Data Name='ProcessGuid'>{46de3de3-8366-6962-8741-000000000800}</Data><Data Name='ProcessId'>6224</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{46de3de3-8365-6962-8541-000000000800}</Data><Data Name='ParentProcessId'>1352</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>255</EventID><Version>3</Version><Level>2</Level><Task>255</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:25:01.2458351Z'/><EventRecordID>30222</EventRecordID><Correlation/><Execution ProcessID='5644' ThreadID='5748'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='UtcTime'>2026-01-10 16:25:01.242</Data><Data Name='ID'>ConfigMonitorThread</Data><Data Name='Description'>Failed to send message to the driver to update configuration - Last error: The system cannot find the file specified.
</Data></EventData></Event>


_raw:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>255</EventID><Version>3</Version><Level>2</Level><Task>255</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T16:05:45.7225870Z'/><EventRecordID>30720</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='4964'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='UtcTime'>2026-01-10 16:05:45.721</Data><Data Name='ID'>ConfigMonitorThread</Data><Data Name='Description'>Failed to send message to the driver to update configuration - Last error: The system cannot find the file specified.
</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:58:15.7227198Z'/><EventRecordID>2718193</EventRecordID><Correlation/><Execution ProcessID='6004' ThreadID='5224'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 15:58:15.677</Data><Data Name='ProcessGuid'>{d5955fcb-7717-6962-f640-000000000800}</Data><Data Name='ProcessId'>6452</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d5955fcb-e24e-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{d5955fcb-7717-6962-f540-000000000800}</Data><Data Name='ParentProcessId'>5392</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:58:15.0510439Z'/><EventRecordID>752183</EventRecordID><Correlation/><Execution ProcessID='6056' ThreadID='5380'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 15:58:15.047</Data><Data Name='ProcessGuid'>{108affa0-7717-6962-9641-000000000800}</Data><Data Name='ProcessId'>5180</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{108affa0-e249-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{108affa0-7716-6962-9441-000000000800}</Data><Data Name='ParentProcessId'>7960</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:58:15.0345608Z'/><EventRecordID>752181</EventRecordID><Correlation/><Execution ProcessID='6056' ThreadID='5380'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 15:58:15.032</Data><Data Name='ProcessGuid'>{108affa0-7717-6962-9541-000000000800}</Data><Data Name='ProcessId'>7064</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{108affa0-e249-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{108affa0-7716-6962-9441-000000000800}</Data><Data Name='ParentProcessId'>7960</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:58:14.6367346Z'/><EventRecordID>2718159</EventRecordID><Correlation/><Execution ProcessID='6004' ThreadID='5224'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 15:58:14.619</Data><Data Name='ProcessGuid'>{d5955fcb-7716-6962-ef40-000000000800}</Data><Data Name='ProcessId'>2908</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d5955fcb-e24e-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d5955fcb-7716-6962-ee40-000000000800}</Data><Data Name='ParentProcessId'>7104</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:58:13.3282145Z'/><EventRecordID>752171</EventRecordID><Correlation/><Execution ProcessID='6056' ThreadID='5380'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 15:58:13.197</Data><Data Name='ProcessGuid'>{108affa0-7715-6962-9341-000000000800}</Data><Data Name='ProcessId'>4348</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{108affa0-e249-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{108affa0-7715-6962-9241-000000000800}</Data><Data Name='ParentProcessId'>7164</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:58:11.9710660Z'/><EventRecordID>752134</EventRecordID><Correlation/><Execution ProcessID='6056' ThreadID='5380'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 15:58:11.951</Data><Data Name='ProcessGuid'>{108affa0-7713-6962-8f41-000000000800}</Data><Data Name='ProcessId'>5288</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{108affa0-e249-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{108affa0-7713-6962-8e41-000000000800}</Data><Data Name='ParentProcessId'>6836</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:57:04.6887726Z'/><EventRecordID>29749</EventRecordID><Correlation/><Execution ProcessID='5540' ThreadID='5704'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 15:57:04.685</Data><Data Name='ProcessGuid'>{09708317-76d0-6962-9240-000000000800}</Data><Data Name='ProcessId'>4808</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{09708317-e1f4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{09708317-76d0-6962-9040-000000000800}</Data><Data Name='ParentProcessId'>6972</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:57:04.6832823Z'/><EventRecordID>29748</EventRecordID><Correlation/><Execution ProcessID='5540' ThreadID='5704'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 15:57:04.680</Data><Data Name='ProcessGuid'>{09708317-76d0-6962-9140-000000000800}</Data><Data Name='ProcessId'>7076</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{09708317-e1f4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{09708317-76d0-6962-9040-000000000800}</Data><Data Name='ParentProcessId'>6972</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:57:03.7122651Z'/><EventRecordID>29721</EventRecordID><Correlation/><Execution ProcessID='5540' ThreadID='5704'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 15:57:03.699</Data><Data Name='ProcessGuid'>{09708317-76cf-6962-8c40-000000000800}</Data><Data Name='ProcessId'>5640</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{09708317-e1f4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{09708317-76cf-6962-8b40-000000000800}</Data><Data Name='ParentProcessId'>6432</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:57:03.3300298Z'/><EventRecordID>29711</EventRecordID><Correlation/><Execution ProcessID='5540' ThreadID='5704'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 15:57:03.320</Data><Data Name='ProcessGuid'>{09708317-76cf-6962-8740-000000000800}</Data><Data Name='ProcessId'>6892</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{09708317-e1f4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{09708317-76cf-6962-8640-000000000800}</Data><Data Name='ParentProcessId'>6216</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:56:08.3222660Z'/><EventRecordID>33402</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 15:56:08.319</Data><Data Name='ProcessGuid'>{b5ee82db-7698-6962-c240-000000000800}</Data><Data Name='ProcessId'>4744</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{b5ee82db-7698-6962-c040-000000000800}</Data><Data Name='ParentProcessId'>6224</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:56:08.3161938Z'/><EventRecordID>33401</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 15:56:08.310</Data><Data Name='ProcessGuid'>{b5ee82db-7698-6962-c140-000000000800}</Data><Data Name='ProcessId'>6652</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{b5ee82db-7698-6962-c040-000000000800}</Data><Data Name='ParentProcessId'>6224</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:56:06.9223761Z'/><EventRecordID>33366</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 15:56:06.907</Data><Data Name='ProcessGuid'>{b5ee82db-7696-6962-ba40-000000000800}</Data><Data Name='ProcessId'>7936</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{b5ee82db-7696-6962-b940-000000000800}</Data><Data Name='ParentProcessId'>6700</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:56:05.9279467Z'/><EventRecordID>33333</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 15:56:05.916</Data><Data Name='ProcessGuid'>{b5ee82db-7695-6962-b540-000000000800}</Data><Data Name='ProcessId'>832</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-7695-6962-b440-000000000800}</Data><Data Name='ParentProcessId'>4944</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:55:55.0982719Z'/><EventRecordID>30762</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 15:55:55.095</Data><Data Name='ProcessGuid'>{d79348b5-768b-6962-2941-000000000800}</Data><Data Name='ProcessId'>5444</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{d79348b5-768b-6962-2741-000000000800}</Data><Data Name='ParentProcessId'>2360</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:55:55.0918593Z'/><EventRecordID>30761</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 15:55:55.088</Data><Data Name='ProcessGuid'>{d79348b5-768b-6962-2841-000000000800}</Data><Data Name='ProcessId'>6912</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{d79348b5-768b-6962-2741-000000000800}</Data><Data Name='ParentProcessId'>2360</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:55:53.9849355Z'/><EventRecordID>30739</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 15:55:53.980</Data><Data Name='ProcessGuid'>{d79348b5-7689-6962-2541-000000000800}</Data><Data Name='ProcessId'>6864</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{d79348b5-7689-6962-2441-000000000800}</Data><Data Name='ParentProcessId'>1256</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T15:55:53.4120103Z'/><EventRecordID>30723</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 15:55:53.379</Data><Data Name='ProcessGuid'>{d79348b5-7689-6962-1e41-000000000800}</Data><Data Name='ProcessId'>6664</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-7689-6962-1d41-000000000800}</Data><Data Name='ParentProcessId'>6148</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>